Technology
Passkeys and phishing-resistant authentication for agency staff
Why one-time codes are no longer enough, what passkeys and security keys change, and how to roll them out.
Multi-factor authentication with one-time codes or push notifications stops password theft but not a determined phisher, who can relay the code or wear a user down with prompts until one is approved. Phishing-resistant authentication closes that gap, and it has become practical for ordinary staff.
What phishing-resistant means
The credential is bound to the legitimate website and cannot be used on a fake one. Two forms are common: hardware security keys, and passkeys, which store the same kind of credential on a phone or computer and unlock it with the device's biometric or PIN.
Why it matters for agencies
Credential phishing is the leading way attackers gain a foothold before ransomware or fraud. Federal guidance directs agencies toward phishing-resistant methods, cyber insurers ask about it, and it satisfies the strongest interpretation of CJIS authentication requirements.
Where to start
- Administrators and privileged accounts, with hardware keys.
- Finance, HR, and executives, who are targeted for fraud.
- General staff, with passkeys on managed devices.
- Shared workstations and field devices, which need specific designs such as keys or badge-based options.
Practical considerations
- Identity platform support: most major platforms support passkeys and security keys natively.
- Device management: passkeys on managed devices are simpler to support than on personal ones.
- Recovery: a defined process for lost devices that does not fall back to a phishable method.
- Legacy applications: some cannot use modern authentication and need single sign-on in front of them or a plan for replacement.
- Training: short, hands-on enrollment sessions work better than documents.
Measuring
Share of accounts on phishing-resistant methods, by role. Report it to leadership as a security metric.
Cost
Passkeys cost nothing beyond the identity platform. Hardware keys are inexpensive relative to the accounts they protect.
Where HQT fits
Identity architecture, rollout planning, integration of applications with single sign-on, and the recovery and support procedures that make the change stick.